SINEC NMS CVE-2025-40755

Exploitation requires an authenticated low-privileged account on SINEC NMS (PR:L) with network access to the application's web interface; no user interaction is needed. The attacker must be able to reach the getTotalAndFilterCounts endpoint and submit injectable input. The limiting factor is the authentication requirement - this is not exploitable by fully unauthenticated outsiders - combined with the niche deployment footprint (Siemens industrial network management). All versions below V4.0 SP1 are affected; upgrading to V4.0 SP1 remediates.

This is a genuine, high-severity vulnerability but not an immediate emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H, base 8.7) shows a remotely reachable, low-complexity SQL injection requiring only low-privileged authentication, with high impact across confidentiality, integrity and availability. Countering the high CVSS, exploitation signals are modest: EPSS is only 0.37% (29th percentile), there is no CISA KEV listing, and no public exploit code was identified - so despite the ZDI research pedigree (ZDI-CAN-26570), there is no evidence of active or imminent mass exploitation. The mitigating gate is meaningful: an attacker must already hold valid low-privilege credentials to the SINEC NMS application, which limits the population of realistic attackers to insiders or those who have already obtained a foothold or captured credentials. Signals are internally consistent (network SQLi requiring authentication matches the description of an authenticated low-priv attacker), so no contradictions require vendor verification. Overall this is a real priority for organizations running SINEC NMS in OT/industrial network-management roles - the privilege-escalation outcome is serious - but its niche deployment and authentication requirement keep real-world risk moderate rather than critical.

An attacker with a low-privileged SINEC NMS account (an insider, or an outsider who has phished or otherwise obtained operator credentials) sends a crafted request to the getTotalAndFilterCounts endpoint containing malicious SQL. The injection lets them insert or manipulate backend database records, which they leverage to escalate their privileges to a higher-privileged application role, gaining control over the network-management platform. No public proof-of-concept exploit was identified at the time of analysis.